Fix GH-23911: Cached static closure keeps static:: of the first called class

The stateless closure cache in ZEND_DECLARE_LAMBDA_FUNCTION stored a single
closure per opline. Since the declaring op_array is shared by all subclasses,
the closure created for the first called scope was returned for every other
called scope, breaking static::, new static() and get_called_class().

Store the called scope alongside the cached closure and only reuse the closure
for a matching called scope. The slot is only filled once, as replacing the
cached closure on a mismatch would grow EG(lambda_cache) without bounds.

Fixes GH-23911

Signed-off-by: Roman Ondráček <mail@romanondracek.cz>

Author: Roman3349

Zend/Optimizer/compact_literals.c

@@ -757,12 +757,17 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					}
 					break;
 				case ZEND_CALLABLE_CONVERT:
-				case ZEND_DECLARE_LAMBDA_FUNCTION:
 					if (opline->extended_value != (uint32_t)-1) {
 						opline->extended_value = cache_size;
 						cache_size += sizeof(void *);
 					}
 					break;
+				case ZEND_DECLARE_LAMBDA_FUNCTION:
+					if (opline->extended_value != (uint32_t)-1) {
+						opline->extended_value = cache_size;
+						cache_size += 2 * sizeof(void *);
+					}
+					break;
 				case ZEND_CALLABLE_CONVERT_PARTIAL:
 					opline->extended_value = cache_size | (opline->extended_value & ZEND_PARTIAL_FLAGS);
 					cache_size += 2 * sizeof(void *);

Zend/tests/closures/gh23911.phpt

@@ -0,0 +1,45 @@
+--TEST--
+GH-23911: Cached static closure keeps static:: of the first called class
+--FILE--
+<?php
+
+class A {
+    public static function name(): string {
+        return (static fn () => static::class)();
+    }
+
+    public static function create(): static {
+        return (static fn () => new static())();
+    }
+
+    public function calledClass(): string {
+        return (static function () {
+            return get_called_class();
+        })();
+    }
+}
+class B extends A {}
+class C extends A {}
+
+var_dump(B::name(), C::name(), B::name(), A::name());
+var_dump(B::create()::class, C::create()::class);
+var_dump((new B)->calledClass(), (new C)->calledClass());
+
+function f() {
+    return static fn () => 42;
+}
+var_dump(f() === f());
+var_dump(B::name(...) !== C::name(...));
+
+?>
+--EXPECT--
+string(1) "B"
+string(1) "C"
+string(1) "B"
+string(1) "A"
+string(1) "B"
+string(1) "C"
+string(1) "B"
+string(1) "C"
+bool(true)
+bool(true)

Zend/zend_compile.c

@@ -9273,8 +9273,9 @@ static zend_op_array *zend_compile_func_decl_ex(
 		 && declaring_op_array->last) {
 			zend_op *declare_lambda_op = &declaring_op_array->opcodes[declaring_op_array->last - 1];
 			if (declare_lambda_op->opcode == ZEND_DECLARE_LAMBDA_FUNCTION) {
+				/* Cache slot pair of called scope and closure. */
 				declare_lambda_op->extended_value = declaring_op_array->cache_size;
-				declaring_op_array->cache_size += sizeof(void *);
+				declaring_op_array->cache_size += 2 * sizeof(void *);
 			}
 		}
 	}

Zend/zend_vm_def.h

@@ -8420,34 +8420,40 @@ ZEND_VM_HANDLER(142, ZEND_DECLARE_LAMBDA_FUNCTION, UNUSED, NUM, NUM|CACHE_SLOT)
 	zend_object *object;
 	zend_class_entry *called_scope;
 
+	if (Z_TYPE(EX(This)) == IS_OBJECT) {
+		called_scope = Z_OBJCE(EX(This));
+	} else {
+		called_scope = Z_CE(EX(This));
+	}
+
 	if (opline->extended_value != (uint32_t)-1) {
-		zend_object *closure = CACHED_PTR(opline->extended_value);
+		/* The closure is bound to the called scope, so it may only be reused
+		 * for the same called scope. */
+		zend_object *closure = CACHED_POLYMORPHIC_PTR(opline->extended_value, called_scope);
 		if (closure) {
 			ZVAL_OBJ_COPY(EX_VAR(opline->result.var), closure);
 			ZEND_VM_NEXT_OPCODE();
 		}
 	}
 
 	func = (zend_function *) EX(func)->op_array.dynamic_func_defs[opline->op2.num];
-	if (Z_TYPE(EX(This)) == IS_OBJECT) {
-		called_scope = Z_OBJCE(EX(This));
-		if (UNEXPECTED((func->common.fn_flags & ZEND_ACC_STATIC) ||
-				(EX(func)->common.fn_flags & ZEND_ACC_STATIC))) {
-			object = NULL;
-		} else {
-			object = Z_OBJ(EX(This));
-		}
+	if (Z_TYPE(EX(This)) == IS_OBJECT
+	 && EXPECTED(!(func->common.fn_flags & ZEND_ACC_STATIC))
+	 && EXPECTED(!(EX(func)->common.fn_flags & ZEND_ACC_STATIC))) {
+		object = Z_OBJ(EX(This));
 	} else {
-		called_scope = Z_CE(EX(This));
 		object = NULL;
 	}
 	SAVE_OPLINE();
 	zend_create_closure(EX_VAR(opline->result.var), func,
 		EX(func)->op_array.scope, called_scope, object);
-	if (opline->extended_value != (uint32_t)-1) {
+	/* Only fill an empty cache slot. Replacing a cached closure on a called
+	 * scope mismatch would grow EG(lambda_cache) without bounds. */
+	if (opline->extended_value != (uint32_t)-1
+	 && !CACHED_PTR(opline->extended_value + sizeof(void *))) {
 		zend_object *closure = Z_OBJ_P(EX_VAR(opline->result.var));
 		GC_ADDREF(closure);
-		CACHE_PTR(opline->extended_value, closure);
+		CACHE_POLYMORPHIC_PTR(opline->extended_value, called_scope, closure);
 		zend_stack_push(&EG(lambda_cache), &closure);
 	}
 	ZEND_VM_NEXT_OPCODE();